CVE-2016-5387

57

FAUCET Score

CVE-2016-5387, known as "httpoxy," identifies a mitigation for a scenario where Apache HTTP Server through version 2.4.23 could allow remote attackers to redirect an application's outbound HTTP traffic. This occurs by manipulating the HTTP_PROXY environment variable via a crafted Proxy header, impacting products from vendors like Apache, Debian, and Red Hat. Rated with a CVSSv3 score of 8.1 (HIGH), this issue has a network attack vector and high attack complexity, potentially leading to high impact on confidentiality, integrity, and availability. Its EPSS score of 0.602830000 suggests a higher-than-average probability of exploitation. While it is not listed in CISA's Known Exploited Vulnerabilities catalog and lacks public exploit code, it is on a "Hot List" and has received notable media coverage and community discussion.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 2.2.0, <= 2.2.31CPE matchmatch criteria	cpe:2.3:a:apache:http_server::::::::
		>= 2.4.1, <= 2.4.23CPE matchmatch criteria	cpe:2.3:a:apache:http_server::::::::
		<= 7.5.5.0CPE matchmatch criteria	cpe:2.3:a:hp:system_management_homepage::::::::
		>= 10.0.0, <= 12.4CPE matchmatch criteria	cpe:2.3:a:oracle:communications_user_data_repository::::::::
		12.2.2CPE matchmatch criteria	cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:::::::*

CVSS Data

CVSS version used by this source: 3.1

8.1HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

2.2

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

55.72%

Probability of exploitation in next 30 days

EPSS Percentile

98.9%

Percentile rank of EPSS score among Peer Group

As of 2026-07-24

Model: v2026.06.15

This CVE's current EPSS score of 0.5572 is in the 98th percentile among its peer group of 8,914 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (38)

apachepatch availablevia llm_extracted

Fixed in: 2.4

oraclepatch availablevia nvd_reference

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: httpd-0:2.2.26-54.ep6.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-httpd-0:2.4.6-77.SP1.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-httpd-0:2.4.6-77.SP1.jbcs.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: httpd-0:2.2.3-92.el5_11

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: httpd-0:2.2.15-54.el6_8

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: jbcs-httpd24-0:1-3.jbcs.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: jbcs-httpd24-openssl-1:1.0.2h-4.jbcs.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: mod_cluster-0:1.2.13-1.Final_redhat_1.1.ep6.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: mod_cluster-native-0:1.2.13-3.Final_redhat_2.ep6.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: mod_jk-0:1.2.41-2.redhat_3.ep6.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: tomcat-native-0:1.1.34-5.redhat_1.ep6.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 7Fixed in: httpd22-0:2.2.26-56.ep6.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 7Fixed in: jbcs-httpd24-0:1-3.jbcs.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 7Fixed in: jbcs-httpd24-openssl-1:1.0.2h-4.jbcs.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 7Fixed in: mod_cluster-0:1.2.13-1.Final_redhat_1.1.ep6.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 7Fixed in: mod_cluster-native-0:1.2.13-3.Final_redhat_2.ep6.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 7Fixed in: tomcat-native-0:1.1.34-5.redhat_1.ep6.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 2.1

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 3.0

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 3 for RHEL 6Fixed in: httpd24-0:2.4.6-62.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 3 for RHEL 6Fixed in: tomcat7-0:7.0.59-51_patch_01.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 3 for RHEL 6Fixed in: tomcat8-0:8.0.18-62_patch_01.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 3 for RHEL 7Fixed in: httpd24-0:2.4.6-62.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 3 for RHEL 7Fixed in: tomcat7-0:7.0.59-51_patch_01.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 3 for RHEL 7Fixed in: tomcat8-0:8.0.18-62_patch_01.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: httpd24-httpd-0:2.4.18-11.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUSFixed in: httpd24-httpd-0:2.4.18-11.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUSFixed in: httpd24-httpd-0:2.4.18-11.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: httpd24-httpd-0:2.4.18-11.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUSFixed in: httpd24-httpd-0:2.4.18-11.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUSFixed in: httpd24-httpd-0:2.4.18-11.el7

redhatpatch availablevia redhat_api

Product: Text-Only JBCS

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 7Fixed in: mod_jk-0:1.2.41-2.redhat_3.ep6.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: httpd-0:2.4.6-40.el7_2.4

redhatno patchvia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 6Fixed in: httpd22

redhatend of lifevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1Fixed in: httpd

Vendor Advisories (4)

apachellm-apache-f398f8ed28802aa3LOW

Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project

apachellm-apache-a7a91ec4c0e9421dHIGH

Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project

redhatCVE-2016-5387Important

HTTPD: sets environmental variable based on user supplied Proxy request header

apachellm-apache-684e4d0003611bd4LOW

Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project

References

lists.opensuse.org / opensuse-updates/2016-07/msg00059.html

Mailing ListThird Party Advisory

rhn.redhat.com / errata/RHSA-2016-1624.html

Broken LinkThird Party Advisory

rhn.redhat.com / errata/RHSA-2016-1625.html

Broken LinkThird Party Advisory

rhn.redhat.com / errata/RHSA-2016-1648.html

Third Party Advisory

rhn.redhat.com / errata/RHSA-2016-1649.html

Third Party Advisory

rhn.redhat.com / errata/RHSA-2016-1650.html

Broken LinkThird Party Advisory

access.redhat.com / errata/RHSA-2016:1420

Third Party Advisory

access.redhat.com / errata/RHSA-2016:1421

Third Party Advisory

access.redhat.com / errata/RHSA-2016:1422

Third Party Advisory

access.redhat.com / errata/RHSA-2016:1635

Third Party Advisory

access.redhat.com / errata/RHSA-2016:1636

Third Party Advisory

access.redhat.com / errata/RHSA-2016:1851

Third Party Advisory

h20566.www2.hpe.com / hpsc/doc/public/display

Third Party Advisory

h20566.www2.hpe.com / portal/site/hpsc/public/kb/docDisplay

Third Party Advisory

h20566.www2.hpe.com / portal/site/hpsc/public/kb/docDisplay

Third Party Advisory

Third Party Advisory

lists.apache.org / thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/6WCTE7443AYZ4EGELWLVNANA2WJCJIYI

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/NEKZAB7MTWVSMORHTEMCQNFFMIHCYF76

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/QPQAPWQA774JPDRV4UIB2SZAX6D3UZCV

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/TGNHXJJSWDXAOEYH5TMXDPQVJMQQJOAZ

security.gentoo.org / glsa/201701-36

Third Party Advisory

support.apple.com / HT208221

Third Party Advisory

apache.org / security/asf-httpoxy-response.txt

Vendor Advisory

tenable.com / security/tns-2017-04

Third Party Advisory

debian.org / security/2016/dsa-3623

Third Party Advisory

kb.cert.org / vuls/id/797896

Third Party AdvisoryUS Government Resource

oracle.com / technetwork/security-advisory/cpujan2018-3236628.html

PatchThird Party Advisory

oracle.com / technetwork/security-advisory/cpujul2017-3236622.html

PatchThird Party Advisory

oracle.com / technetwork/topics/security/bulletinoct2016-3090566.html

Third Party Advisory

oracle.com / technetwork/topics/security/linuxbulletinjul2016-3090544.html

Third Party Advisory

securityfocus.com / bid/91816

Third Party AdvisoryVDB Entry

securitytracker.com / id/1036330

Broken LinkThird Party AdvisoryVDB Entry

ubuntu.com / usn/USN-3038-1

Third Party Advisory